Virustotal Scraper
Spider read virustotal.com in 583 ms without a browser and returned 800 lines of clean markdown, including the section "Non-Windows samples".
It's important to highlight that “tag” is one of the few modifiers supporting wildcards.Many of you asked about language specific document searches during our Threat Hunting with VirusTotal session. The “lang:” keyword uses Exif language property to find files matching any language:## Non-Windows samplesWe have dedicated keywords to perform searches for platforms such as Android, MacOS or even Symbian.For Android, which is one of the most popular non-Windows platforms by number of malware samples, we use Androguard to process all ingested samples. You can query for any Androguard output which is stored under the umbrella “androguard:” keyword:This includes all sorts of different types of processed data: code strings, manifest entities, certificate signatures, etc. For example, this example looks for APKs that mimic a legitimate app by using the same icon (“main_icon_dhash”), but signed with a different certificate:main_icon_dhash:9ef2e0c8e8f8bc8e type:apk AND NOT androguard:"45989dc9ad8728c2aa9a82fa55503e34a8879374"However when looking for something specific it is better using “androguard_package:” to search for APKs with explicit package names (please note this only works for newly indexed files since March 2022):androguard_package:org.xmlpush.v3Since this is a new search modifier, please feel free to share our feedback with us.In some cases you can skip using any special keyword and build your query using APK internal paths only:( "assets/s.bin" AND "assets/l.bin" ) OR ( "assets/s.bin" AND "assets/m.bin" ) OR ( "assets/m.bin" AND "assets/c.bin" )%20OR%20(%20%22assets%2Fs.bin%22%20AND%20%22assets%2Fm.bin%22%20)%20OR%20(%20%22assets%2Fm.bin%22%20AND%20%22assets%2Fc.bin%22%20)/files)Here are some more examples for different platforms.tag:iphone tag:signed p:5+ - signed iOS app packages detected by at least 5 AVs.The same call, in code.
The capture above came back as markdown. These examples add a key, so you get browser rendering, proxies, and concurrency on virustotal.com.
import { SpiderBrowser } from "spider-browser";
const spider = new SpiderBrowser({
apiKey: process.env.SPIDER_API_KEY!,
});
await spider.connect();
const page = spider.page!;
await page.goto("https://virustotal.com");
// No selectors, no schema. Spider reads the page and names the fields.
const data = await page.scrape();
console.log(data);
await spider.close();import { Spider } from "@spider-cloud/spider-client";
const spider = new Spider({ apiKey: process.env.SPIDER_API_KEY! });
const result = await spider.scrapeUrl("https://www.virustotal.com", {
return_format: "markdown",
});
console.log(result);Ready for volume? Get an API key →
Fields you can pull.
Spider names these from the page. The capture above came back as markdown; the same
call with return_format: "json" returns them as keys.
What virustotal.com costs to scrape.
The capture above cost $0.000208 to fetch. Pricing is $1 per GB of pre-transformation bandwidth plus $0.001 per CPU minute, so a page like this one lands at a fraction of a cent. Failed requests are billed at $0.
- Free balance on signup
- No card required to test
- Balance never expires
Run it keyless, no account
More Directories scrapers.
Spotify Main Page Scraper
Extract structured data from Spotify Main Page with automated CSS selectors.
Roblox Landing Page Scraper
Roblox landing page metadata and cookie banner information.
Mozilla Homepage Data Scraper
A scraper for extracting all useful data from the Mozilla homepage, including site metadata, navigation, and content.
Start scraping virustotal.com.
You already have the call. A key raises the rate limit and turns on browser rendering, proxies, and concurrency. Balance never expires, and top-ups go through secure checkout.